GNQL V3 Recall
Get hourly GNQL records for a given time range.
Query parameters
GNQL query string
Start date for the desired time range
End date for the desired time range
Specifies the desired format of the results. Must be either csv or json.
Specifies the number of records desired from the backend query. For example, if you specify a limit of 100, you will get the first 100 records for your query, divided up by hour.
Specifies the offset at which to apply the limit. With limit, can be used to paginate through a large response. For example, if you specify a limit of 100 and and an offset of 200, you will get the next 100 records starting at the 200th record.
Response
Query successful.
Response object for the timeseries endpoint. The response is a map where keys are time intervals and values are arrays of IP records observed in that interval.
Time interval keys are formatted as YYYY-MM-DD-HH (e.g., "2025-01-15-14")
Example response
{
"2025-11-10-14": [
{
"ip": "203.0.113.45",
"internet_scanner_intelligence": {
"first_seen": "2018-01-28",
"last_seen": "2018-02-28",
"found": true,
"tags": [
"Mirai",
"Telnet Worm"
],
"actor": "Shodan.io",
"spoofable": true,
"classification": "benign",
"cves": [
"CVE-2020-1234",
"CVE-2021-2345"
],
"vpn": true,
"vpn_service": "IPVANISH_VPN",
"tor": false,
"last_seen_timestamp": "2025-01-15T12:30:45Z",
"metadata": {
"asn": "AS13335",
"source_country": "United States",
"source_country_code": "US",
"organization": "Example Hosting"
},
"raw_data": {
"scan": [
{
"port": 22,
"protocol": "tcp"
}
]
}
}
}
]
}